Start from a saved view
The list opens on Validated exploits. This view shows the findings that an agent proved in production. Four views are available:Filter and search
You can add filters to a view. You can remove each filter separately.
For a more complex filter, write an Advanced query expression, such as
origin:wiz severity:critical. The URL keeps the filter. Thus, you can send a filtered view to a teammate.
Act on many findings at once
Select more than one finding. Then you can create tickets for all of them in Linear or Fibery. You can also export them as a PDF report.Keep the record
Each finding keeps a status history. The history shows each status change, the person who made it, and the justification. The chronology of a finding shows when an agent detected it, exploited it, and retested it. It also shows when someone closed it. Your team can also attach evidence files to a finding, such as a review PDF.Report an issue yourself
You can add an issue that you found yourself or that a customer told you about. Use Report a finding. Give the issue a title, a description, and a location. Also give your estimate of its severity. Tolmo grades the issue during triage.Duplicates
Sometimes two scanners report the same issue. Tolmo then marks one finding as Duplicate and links it to the other finding. Work on the original finding. You can see the duplicate with its own filter.Secret detections
Detected secrets are not in the findings list. An example of a detected secret is an API key in a repository commit. To read detected secrets, use the API endpoint List secret findings. Each detection contains these items:- Its resource, rule, and severity.
- The times when Tolmo observed it.
- Its triage verdict, if a verdict exists.
Work from the CLI or API
The CLI and the API give you access to the same findings:Next steps
Fix a finding
Copy the fix prompt, link the pull request, or create a ticket.
Query findings with SQL
Ask the questions that filters cannot answer.